Re: [Caml-list] Hashtbl and security

[Goswin von Brederlow <goswin-v-b@web.de>]

Xavier Leroy <Xavier.Leroy@inria.fr> writes:

> On 01/01/2012 01:52 PM, Richard W.M. Jones wrote:
>> On Fri, Dec 30, 2011 at 06:06:26PM +0100, Xavier Leroy wrote:
>>> Indeed.  The optional "seed" parameter to Hashtbl.create does exactly
>>> this in the new implementation of Hashtbl (the one based on Murmur3).
>> 
>> It may be worth noting that Perl solved this problem (back in 2003) by
>> unconditionally using a seed which is a global set to a random number
>> during interpreter initialization.  
>
> That's how my initial reimplementation of Hashtbl worked, using the
> Random module to produce seeds, but I was told (correctly) that in
> security-sensitive applications it's better to leave the generation of
> random numbers under control of the programmer.  For some applications
> Random.self_init might be good enough and for others stronger
> randomness is needed.
>
> Of course, you can trivially emulate Perl's behavior using the new
> Hashtbl implementation + the Random module.
>
> - Xavier Leroy

It is also crucial if you are doing performance tests or debugging. You
want the same behaviour on every run for that.

MfG
        Goswin